huawei-cloud-rds-failover

• Outcome: Review
• Latest audit: Sep 22, 2026 · 3:10 AM UTC
• Version: 1.0.1

Overview

This skill appears to do what it says, but it can run a real Huawei Cloud database failover that may interrupt service.

Install only if you intentionally need Huawei Cloud RDS failover automation. Treat any command with --yes as a live database role switch, verify config/config.json targets the intended non-production instance or an approved maintenance window, and use a least-privilege hcloud profile limited to the required RDS/CES actions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (15)

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The document instructs users to run a real RDS failover with `--yes`, which performs a disruptive infrastructure action, but it does not place an explicit warning immediately before the command about service interruption, role reversal, and the need to avoid production unless formally approved. In an operational runbook-style skill, omission of these safeguards can cause accidental execution against live HA databases, leading to downtime, application errors, and operational impact.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The end-to-end verification flow includes an actual failover step as part of a linear validation sequence, which increases the chance that a user will execute it routinely while following the checklist. Because there is no clear warning about production impact or separation between safe dry-run validation and destructive testing, the documentation can normalize risky execution and lead to unintended service disruption.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill describes capabilities that imply shell execution, environment access, and file read/write, but it does not declare any explicit tool scope or permission boundaries. In a skill that can initiate a real RDS failover, missing scope declarations increases the risk of over-privileged execution, unintended command use, and unsafe access to credentials or local files.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The skill metadata and documentation are presented in Chinese, but there is no statement that the skill supports language selection or that Chinese is a required locale for a region-specific compliance reason. This can conflict with organizational language/locale policy when a skill implicitly fixes the interaction language without user opt-in.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger list includes broad terms like `failover`, `主备切换`, and similar generic phrases that may match requests outside the intended Huawei Cloud RDS HA context. This can cause unintended activation of a skill that performs or prepares a high-impact infrastructure change, increasing the chance of accidental execution against production systems.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The activation conditions are broad and describe when the skill should trigger, but not when it must refuse or defer. In the context of a destructive operational action like database failover, ambiguous activation boundaries can lead the agent to invoke the skill for exploratory, hypothetical, or insufficiently scoped requests, raising the risk of accidental disruption.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: The title and all user-facing instructions in this skill file are written only in Chinese, with no indication that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. The policy requires flagging language or locale constraints when they are imposed without user opt-in or clear justification.

Natural-Language Policy Violations

Medium

• Confidence: 89% confidence
• Finding: This markdown file presents all operational instructions and warnings exclusively in Chinese, which can constitute a language/locale policy violation when no user opt-in or alternative language is provided. The document does not state that the skill is region-specific or otherwise justified to require Chinese-only instructions.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if extra_args:
        cmd.extend(extra_args)
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
    except subprocess.TimeoutExpired:
        return {"_error": True, "stderr": "hcloud command timed out (120s)"}
    if result.returncode != 0:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if extra_args:
        cmd.extend(extra_args)
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
    except subprocess.TimeoutExpired:
        return {"_error": True, "stderr": "hcloud command timed out (120s)"}
    if result.returncode != 0:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code file contains natural-language strings for usage instructions, argument descriptions, and runtime output only in Chinese. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

elif phase == "report":
        cmd.extend(["--config-dir", config_dir])

    result = subprocess.run(cmd, cwd=SCRIPT_DIR)
    return result.returncode == 0

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 86% confidence
• Finding: The module docstring and all user-facing error/help messages in this file are written only in Chinese, which imposes a specific language on users. The provided policy says to flag language or locale constraints unless the skill offers a language choice or clearly documents a justified regional requirement.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: This code hard-codes the output document language to Simplified Chinese in the generated HTML. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy concern unless the constraint is explicitly justified or configurable.

Natural-Language Policy Violations

Low

• Confidence: 92% confidence
• Finding: This code forces a specific language/locale in the generated HTML and surrounding UI strings. Under the policy, locale constraints should either be optional for the user or clearly justified as region-specific; neither is present in this file.

Static analysis

No suspicious patterns detected.